vBulletin 3.0.13 Released

[Kier]

vBulletin 3.0.13

This release of vBulletin addresses a minor cross-site scripting flaw discovered by imei addmimistrator, fixes numerous bugs and adds a new feature.

New Feature: Enhanced File Diagnostics

In previous versions of vBulletin, the 'Suspect File Versions' system (AdminCP > Maintenance > Diagnostics > Suspect File Versions) performed a check on each file found to ensure that its stated version matched the currently-installed version of vBulletin. Therefore, a 3.0.11 version of forumdisplay.php would be flagged for attention on a board running 3.0.12.

The new and improved suspect file versions system extends the file checking functionality in the following ways:

1. File version mismatch:
   The system still checks for mismatched versions
2. File not found:
   The system will identify any missing files
3. File not recognised:
   It will also flag any script files in vBulletin directories that are not part of vBulletin
4. Unexpected file contents:
   The final and most important check is that on download, MD5 sums are generated for every script file in the downloaded package. The system will now compare the original MD5 sum of each file with its current MD5 sum, so it is now possible to tell instantly if any files have been modified from their original state, making it very simple to see if hacks have been installed or if files have not been uploaded correctly.

Updating your vBulletin to combat the XSS flaw:

Versions of vBulletin 3.0 from 3.0.0 Beta 3 to 3.0.12 are affected by the XSS flaw so we recommend that customers upgrade or patch their installations.

For the vBulletin 3.0.x branch, the problem can be resolved in one of two ways.

1. Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.0.13 package from the vBulletin Members' Area and following the regular upgrade instructions.
2. Patch: A second option is to download the patch files discussed in this thread and upload them to your web server, overwriting the existing files.

For a complete list of bugs fixed in 3.0.13, please click here.

[Kier]

Patch File

Patches are now available in the members' area. You may view available patches here.

Go to the page mentioned above and download the "Security patch for 3.0.12". Extract the zip archive, then connect to your web server using FTP and overwrite the following files using the replacement versions from the zip.

• sendmessage.php
• includes/functions.php

Notes:

• You do not need to download this patch if you perform a full upgrade to 3.0.13.

To repeat, go here to download the "Security patch for 3.0.12".

[Kier]

Files changed from 3.0.12 to 3.0.13

• /
  
  • search.php
    
  • sendmessage.php
    
• admincp/
  
  • diagnostic.php
    
  • global.php
    
  • user.php
    
• archive/
  
  • index.php
    
• includes/
  
  • functions.php
    
• install/ - assume all files have changed
• modcp/
  
  • global.php
    

No templates were changed between 3.0.12 and 3.0.13.

[Kier]

A thread for the purpose of discussing the release of vBulletin 3.0.13 is provided here:

http://www.vbulletin.com/forum/showthread.php?t=176179

[Mike Sullivan]

admincp/diagnostic.php

Due to issues that affect a limited number of customers when running the updated "Suspect File Versions" system (see the first post), admincp/diagnostic.php has been updated as of this post.

You do not need to update this file if you do not plan on using this system or have already used it without any problem since upgrading to 3.0.13. Customers that may be affected will be running PHP versions less than 4.2.0 or have renamed their admin/moderator control panel directories.

[Mike Sullivan]

Issue with patch file

An issue has been discovered with the version of functions.php in the patch file. This only affects users who have chosen to patch; full upgrades are not affected.

The issue relates to some users not being able to stay logged in after applying the patch. If you have this problem, you should redownload the patch from this page. We apologize for any inconvienence.